Intel Exchange

The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.

The ClickFix campaign compromised a regional news outlet using malicious JavaScript to deliver social engineering prompts that lead to the execution of an encrypted .NET infostealer.

An unidentified ransomware-related threat actor is using SloppyRAT, a new multi-stage malware, to establish network footholds via ClickFix lures and blockchain-based C2 resolution.

A malicious LNK file disguised as an OIC invitation uses PowerShell to download an archive that installs PlugX via DLL side-loading through a Jarte-derived application.

Anthropic identifies multi-vector misuse of Claude AI models by state-sponsored actors (Russia, China, Iran), financially motivated groups (ShinyHunters), and commercial entities for cyber operations, surveillance, and conventional weapons development.

Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.

The Iran-linked threat actor Handala Hack uses the HEAVYGRAM Telegram-based backdoor and CRUDEEXCLUDE utility to target dissidents and journalists for surveillance and data exfiltration.

China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.

BabylonRAT is an open-source Remote Access Trojan (RAT) capable of credential theft, keylogging, and DDoS attacks, recently used in campaigns targeting public institutions in Malaysia.

Casbaneiro banking trojan targets Latin American users via geofenced phishing and a multi-stage AutoIt infection chain to exfiltrate financial credentials.